Citrix NetScaler Zero-Day Exploited to Compromise Government Organizations

Two important security vulnerabilities, particularly CVE-2023-4966 and CVE-2023-4967, were display in NetScaler ADC and NetScaler Gateway.

These vulnerabilities affect quite rather a lot of variations of the products, and users are strongly suggested to take swift bolt to fetch their programs.

The next supported variations of NetScaler ADC and NetScaler Gateway are identified to be at risk of these factors:

• NetScaler ADC and NetScaler Gateway 14.1 sooner than 14.1-8.50
• NetScaler ADC and NetScaler Gateway 13.1 sooner than 13.1-49.15
• NetScaler ADC and NetScaler Gateway 13.0 sooner than 13.0-92.19
• NetScaler ADC 13.1-FIPS sooner than 13.1-37.164
• NetScaler ADC 12.1-FIPS sooner than 12.1-55.300
• NetScaler ADC 12.1-NDcPP sooner than 12.1-55.300

Please demonstrate that NetScaler ADC and NetScaler Gateway model 12.1 maintain reached their Finish-of-Life (EOL) situation, making them seriously vulnerable.

Most modern Assault Exploiting Zero-Day

Citrix announced this disaster in a security bulletin on October 10, 2023. Alternatively, Mandiant found that some threat actors had already exploited this vulnerability within the wild since tiring August 2023.

This vulnerability enables threat actors to hijack authenticated classes and bypass security features handle multifactor authentication. The hijacked classes would possibly maybe dwell stuffed with life even after making employ of the patch for CVE-2023-4966.

Moreover, some threat actors maintain stolen session files sooner than patching and mature it later for malicious functions. The penalties of authenticated session hijacking are important.

A threat actor with unauthorized glean entry to can employ it to steal more credentials, switch across a community, and glean entry to more resources all thru the centered atmosphere.

Mandiant has reported these annoying trends, staring at exploitation in expert products and companies, expertise, and authorities organizations.

Mandiant has additionally offered extra steerage for mitigating and lowering the risks linked to CVE-2023-4966, recommending that affected parties consult with their CVE-2023-4966 steerage file.

Citrix has stated that potentialities the employ of Citrix-managed cloud products and companies or Adaptive Authentication are unaffected by CVE-2023-4966, giving some help to a subset of their consumer depraved.

The Impact

CVE-2023-4966 is a cozy data disclosure vulnerability with a excessive CVSS gain of 9.4.

This vulnerability impacts appliances configured as a Gateway, VPN digital server, ICA Proxy, CVPN, RDP Proxy, or AAA digital servers.

CVE-2023-4967 is a denial of service vulnerability with a CVSS gain of 8.2.

It additionally impacts appliances configured as a Gateway, VPN digital server, ICA Proxy, CVPN, RDP Proxy, or AAA digital servers.

Mitigating Elements

There are no identified mitigating factors, and instantaneous bolt is required.

Exploits of CVE-2023-4966 on unmitigated appliances maintain already been seen.

Therefore, Cloud Instrument Crew urges all NetScaler ADC and NetScaler Gateway potentialities to set up the up to this level variations straight away.

The suggested variations are:

• NetScaler ADC and NetScaler Gateway 14.1-8.50 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-49.15 and later releases of 13.1
• NetScaler ADC and NetScaler Gateway 13.0-92.19 and later releases of 13.0
• NetScaler ADC 13.1-FIPS 13.1-37.164 and later releases of 13.1-FIPS
• NetScaler ADC 12.1-FIPS 12.1-55.300 and later releases of 12.1-FIPS
• NetScaler ADC 12.1-NDcPP 12.1-55.300 and later releases of 12.1-NDcPP

Citrix’s Response

Citrix is actively notifying its potentialities and companions about this security disaster by publishing a security bulletin.

For technical assistance, Citrix users can contact Citrix Technical Reinforce.

Staying Urged

To handle informed about security updates, Citrix strongly recommends that potentialities subscribe to gain signals on every occasion a Citrix security bulletin is created or modified.